The Central Bank of Kenya (the CBK) has published the draft Central Bank of Kenya (Non-Deposit-Taking Credit Providers) Regulations, 2025 (the Draft Regulations). The Draft Regulations propose a comprehensive regulatory framework for non-deposit taking credit providers (NDTCPs) operating in Kenya.
This follows the enactment of the Business Laws (Amendment) Act, 2024 (the BLAA), which expanded scope of regulation under the Central Bank of Kenya Act (the CBK Act) to cover all NDTCPs. Please see our article on the BLAA here.
The CBK is inviting members of the public to submit comments on the Draft Regulations by email to [email protected] by Friday, 5 September 2025. A copy of the Draft Regulations is available here.
Overview of the Draft Regulations
The Draft Regulations aim to bring enhanced oversight, consumer protection, and operational standards to the non-deposit credit sector in Kenya. They set out detailed requirements for licensing, registration, governance, risk management, and market conduct for NDTCPs not otherwise regulated under existing financial laws.
Please see below an overview of some of the key provisions of the Draft Regulations:
Scope and applicability
The new framework will apply to all non-deposit-taking credit businesses in Kenya, except those already regulated under the Banking Act, Microfinance Act, Sacco Societies Act, or other specific statutes. Exemptions also exist for credit arrangements incidental to the sale of goods or services and for entities specifically approved by the CBK.
Licensing and registration
The Draft Regulations distinguish between licensing and registration based on initial capital:
- Licensing: Entities with initial capital exceeding KES 20 million must apply for a licence, providing extensive documentation on ownership, governance, business model, capital sources, risk management, and compliance policies.
- Registration: Entities with initial capital below KES 20 million may apply for registration, with a slightly reduced but still robust set of requirements.
Both processes require fit-and-proper assessments for directors, senior officers, and significant shareholders, as well as annual fees and ongoing compliance obligations. Entities whose capital, borrowings, or loan book surpass the KES 20 million threshold must convert from registration to licensing.
Operational and conduct standards
The Draft Regulations impose strict operational requirements, including:
- Corporate governance: NDTCPs must maintain sound governance structures, clear separation of board and management functions, and robust risk management frameworks.
- Permissible and prohibited activities: NDTCPs may offer loans, asset financing, buy-now-pay-later, credit guarantees, and peer-to-peer lending (with CBK approval), but are expressly prohibited from deposit-taking, foreign exchange, payment services, and other specified activities.
- Physical presence: At least one registered physical office in Kenya is required, and any changes to business locations must be notified to the CBK.
Consumer protection and fair lending
A central focus of the Draft Regulations is consumer protection, with requirements including:
- Transparent disclosures: NDTCPs must provide clear, simple, and comprehensive information on loan terms, costs, and conditions, both at the point of contracting and throughout the customer relationship.
- Fair collection practices: Aggressive, harassing, or deceptive debt collection tactics are strictly prohibited. Only disclosed charges may be recovered, and limits are set on interest recoverable from non-performing loans.
- Complaints handling: NDTCPs must establish accessible complaints redress mechanisms, resolve complaints promptly (ideally within 30 days), and report on complaint handling to the CBK.
- Data protection: Compliance with Kenya’s Data Protection Act is mandatory, with strict controls on the collection, use, and sharing of customer information.
Risk management and reporting
NDTCPs are required to implement comprehensive risk management frameworks covering credit, operational, compliance, reputational, IT, and liquidity risks. Regular reporting to the CBK is mandated, including on financial performance, complaints, non-performing loans, and other key metrics. The CBK retains broad powers for onsite and offsite inspections and may require additional information or direct remedial actions as needed.
Market Conduct and Code of Conduct
The Draft Regulations introduce a binding Code of Conduct, emphasising fairness, transparency, accountability, and reliability in dealings with customers. NDTCPs must train staff, avoid conflicts of interest, protect customer assets, and ensure all marketing and promotional materials are clear and not misleading.
Enforcement and sanctions
The CBK is empowered to impose a range of administrative sanctions for non-compliance, including monetary penalties, suspension or revocation of licences, restrictions on business activities, and disqualification of directors or shareholders. The process includes notice and opportunity to respond, with sanctions determined on a case-by-case basis considering the severity and impact of violations.
Transition and repeal of previous regulations
Entities operating as NDTCPs at the commencement of the regulations must apply for a licence within six months. The Draft Regulations will repeal the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, consolidating oversight under the new framework.
Foreign lending
The Draft Regulations are still widely drafted such as that if strictly construed, they will apply to foreign lenders such as investment banks, investment funds, foreign banks and development finance institutions. This may have the inadvertent effect of restricting foreign debt capital flows into Kenyan companies. Therefore the concerns raised in our article available here still persist.
Invitation for feedback
We are in the process of preparing detailed comments on the Draft Regulations for submission to the CBK. If you have any concerns, suggestions, or questions regarding the proposed framework, please share them with us at your earliest convenience. For further information or to discuss the implications of the Draft Regulations for your business, please contact Dominic Indokhomi, Cynthia Amutete, Kennedy Makau or your relationship partner at Bowmans.
